I am student i cannot afford to pay the price for KnTDD, do you have other suggestions?
I thought your earlier post said you were using Helix3 (which uses mdd which will work on SP3). Did you stop reading my post half way through?
And in your earlier post you said you knew how to use the tool you just wanted information on how it works. And the whole point on my posts was to get you to divulge the environment and tool info so we could provide useful answers.
mdd is available on Source Forge if you just want that http//
So are you using mdd via Helix3?
If so have you read up on mdd?
I am student i cannot afford to pay the price for KnTDD, do you have other suggestions?
We are just about to release a RAM capturing tool working in kernel mode. If you want a copy (currently, it's pre-release), send me a PM. The tool will be included in our bigger product, Belkasoft Evidence Center, and will be used to capture memory dumps for evidence carving.